URGENT: Malicious server-side rule ('idthienphuoc1') deleting and forwarding all emails - need Outlook engineer assistance

Question

URGENT: Malicious server-side rule ('idthienphuoc1') deleting and forwarding all emails - need Outlook engineer assistance

Arnold Chan 55

My email was hacked around 1am PST and I woke up to find all my emails deleted except for the hacker's scam emails. I'm unable to recover the deleted emails as it seems like they were hard deleted by the hackers. They also created an email forwarding rule that cannot be deleted. The emails are being forwarded to '******@gmail.com' which isn't associated with my accounts. I've renewed my password already and I have the account, but I need someone to completely remove the rule that the hacker set up and also restore some of my emails.

I've tried contacting the Outlook technical support but it keeps looping me back to 'Sign in to see your support options' when I try to go through the 'help' window. I simply cannot get in touch with technical support.

I've reset passwords, signed out of sessions, disabled email forwarding under settings, and tried deleting the rule but it reappears or won't delete.

Please escalate to the Outlook technical team for rule removal and mailbox restore.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Luiz Gustavo Peres da Silva 0 Reputation points

2026-05-11T12:55:24.9+00:00

Estou passando pelo mesmo problema. Já excluí a regra "idthienphuoc1", mas não para de aparecer mensagem na minha caixa de entrada. Preciso de ajuda com o suporte da Microsoft para excluir no servidor. Perdi todos os meus e-mail enviados, mas consegui recuperar os e-mails da caixa de entrada, porém alguns voltaram com a mensagem do rascunho escondendo a mensagem original do e-mail. Perdi meu facebook também, pois o criminoso violou as diretrizes do facebook e fez com que minha conta fosse suspensa e cancelada.
Preciso de ajuda para recuperar meu e-mail e facebook.
Hornblower409 14,900 Reputation points

2026-05-11T13:35:33.8666667+00:00

@Luiz Gustavo Peres da Silva
You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem. This provides much higher visibility to your issue than commenting on an old post, which is only seen by people who are already following this question.

(You can put the link for this page in your new Question for reference)
Dayane Lopes 0 Reputation points

2026-08-13T14:55:28.76+00:00

Minha caixa de entrada está sendo bombardeada com e-mails de vírus e me ameaçando. Preciso de ajuda pra parar com isso
Hornblower409 14,900 Reputation points

2026-08-13T15:11:05.57+00:00

@Dayane Lopes said

My inbox is being bombarded with virus-infected emails

You will not get any help for your issue by adding to an old post. You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem.

Answer accepted by question author

Alice-N 13,370 Microsoft External Staff Moderator

Dear Arnold,

Thank you for reaching out to the Microsoft Q&A Community. I understand you're experiencing an issue with a malicious server-side rule that keeps reappearing and emails being deleted/forwarded. I am happy to assist you with that. Here is a clear approach to help you understand your options:

Step 1: Secure Your Account

Reset your password (you’ve already done this – good).
Sign out of all sessions:
Go to https://account.live.com/Activity and select Sign out everywhere.
Update security info:

Visit https://account.live.com/proofs/manage/additional.

Remove any unknown email/phone numbers.

Add a recovery code and store it safely.
Enable Two-Step Verification if not already enabled.

Step 2: Remove Malicious Rules

If the rule persists, it’s likely stored on the server. Try these steps:

Disable Forwarding:

In Outlook.com, go to Settings > Mail > Forwarding and ensure it’s turned off.

Delete Rules via Outlook Desktop:

If you can install Outlook (Office 2016 or newer):

Add your account to Outlook.
Close Outlook.
Press Windows + R, type: outlook.exe /cleanrules and press Enter.

This removes all client and server-side rules.

If you cannot install Outlook or the rule still reappears, the rule must be removed by Microsoft Support.

Step 3: Restore Deleted Emails

Check Recoverable Items:

In Outlook.com, go to Deleted Items > Recover items deleted from this folder.

If emails are hard-deleted and not visible, only Microsoft Support can attempt a mailbox restore.

Step 4: Contact Microsoft Support Directly

Since this requires backend intervention:

Visit this website: Contact - Microsoft
Type your problems in the search box there. ( For example, Contact support.)
Now click on Get Help and select Contact Support below.
Go to the Products & Services tab and choose the Outlook category
On the Category tab, choose based on your actual problem, such as cannot sign in.
Go to Confirm.
Choose to chat with a support representative or request a call back.
Please visit this link via direct call support and choose your region number

Note: The support contact team only works at certain times, so if the last window shows that it's unavailable, try opening it again the next day. If you prefer phone support, you can leave a phone number. This way, they can call you and help you.

I hope these steps help you resolve the problem. If you require additional guidance, feel free to reply to this thread and I’ll be happy to assist you.

Note: If you found the answer helpful, we’d really appreciate it if you could click "Accept Answer" and kindly give it an upvote. Your feedback helps others in the community too!

Warm Regards

0 comments

2 additional answers

Luiz Gustavo Peres da Silva 0 Reputation points

2026-05-11T12:55:24.9+00:00

Estou passando pelo mesmo problema. Já excluí a regra "idthienphuoc1", mas não para de aparecer mensagem na minha caixa de entrada. Preciso de ajuda com o suporte da Microsoft para excluir no servidor. Perdi todos os meus e-mail enviados, mas consegui recuperar os e-mails da caixa de entrada, porém alguns voltaram com a mensagem do rascunho escondendo a mensagem original do e-mail. Perdi meu facebook também, pois o criminoso violou as diretrizes do facebook e fez com que minha conta fosse suspensa e cancelada.
Preciso de ajuda para recuperar meu e-mail e facebook.
Hornblower409 14,900 Reputation points

2026-05-11T13:35:33.8666667+00:00

@Luiz Gustavo Peres da Silva
You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem. This provides much higher visibility to your issue than commenting on an old post, which is only seen by people who are already following this question.

(You can put the link for this page in your new Question for reference)
Dayane Lopes 0 Reputation points

2026-08-13T14:55:28.76+00:00

Minha caixa de entrada está sendo bombardeada com e-mails de vírus e me ameaçando. Preciso de ajuda pra parar com isso
Hornblower409 14,900 Reputation points

2026-08-13T15:11:05.57+00:00

@Dayane Lopes said

My inbox is being bombarded with virus-infected emails

You will not get any help for your issue by adding to an old post. You need to start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for your specific problem.

Answer 1

Diane Poremsky 8,275 Independent Advisor

Can you turn the rule off?

Do you have office 2016 or newer? If so, add the account to classic Outlook and after it syncs, close Outlook and reopen it using the /cleanrules switch.

To do this, press Windows key + R to open the Run dialog. type or paste the following into the Open field and press Enter or click OK to restart Outlook. (There is a space before /)

outlook.exe /cleanrules

You signed out of the account out everywhere and reset windows hello at the bottom of https://account.live.com/proofs/manage/additional, correct?

You should also create a recovery code at the bottom of that page, especially if you enabled 2-step verification. Keep the code in a safe place and don't forget where it is.

Try this link to contact support: https://support.microsoft.com/contactus

Arnold Chan 55 Reputation points

2025-09-19T01:00:34.79+00:00

Hi, the rule cannot be removed or disabled. It keeps reappearing. I don't have Office but I tried the outlook.exe /cleanrules and the rule still persists.

I need someone to remove the rule for me and I cannot get a hold of anyone. The virtual chat assistant refers me to the Help window in Outlook but it's looping me out and I have no option to contact any assistant.

The community forum is literally the only place I can hope that someone sees and can help with my request.
Diane Poremsky 8,275 Reputation points Independent Advisor

2025-09-20T01:58:27.0733333+00:00

Did you get any errors when you used the command line?

No one here has access to your account. Sorry.

Answer 2

Arnold Chan 55

My Outlook account is still compromised. The malicious server-side rule 'idtienphuoc1' continues to auto-forward emails and potentially delete them. It is out of my control as a user.

I need someone to remove it for me

Diane Poremsky 8,275 Reputation points Independent Advisor

2025-09-20T01:56:11.64+00:00

If you can't disable the rule, you need to contact outlook.com support - they have access to your account on the back end.
Arnold Chan 55 Reputation points

2025-09-20T02:22:14.91+00:00

You're right - I finally got someone on support last night who figured out how to contact the Outlook technical people. They are now fixing it on their side and I have to stay signed out for a few more hours until they're done. I was asked to try removing the rule only until then.
Guillermo Curi 0 Reputation points

2025-09-20T12:27:54.99+00:00

Hi Arnold! I am having the same exactly problem.. (the only difference is that my emails were not deleted...but my Linkedin Profile was kipnapped) including the looping refer to virtual chat assistant and Help window in Outlook. How could you get support from Microsoft? I feel really frustrated and keep looking at Outlook rule all the time so as to delete it as soon as it appears....Thanks!
Arnold Chan 55 Reputation points

2025-09-20T12:35:54.59+00:00

Hi Guillermo. The person who helped me tried a few methods through screen share including different browsers and incognito mode but it was still doing the looping thing. What worked was opening a guest profile on Chrome and browsing as a guest. In that window, log into Outlook and go through the help window again and it should show support options and a link to connect you with the Outlook support. Tell them it's a hidden rule and that it needs to be deleted from their side.
Guillermo Curi 0 Reputation points

2025-09-20T12:37:49.84+00:00

Great! Thanks for the info! I'll do it. HAve a great weekend!
Diane Poremsky 8,275 Reputation points Independent Advisor

2025-09-21T01:42:20.8933333+00:00

Using a guest profile is the same as clearing the browser cache. It sounds like the cache had some corruption, possibly the script that kept recreating the rule.